Tuesday pairs a major hosted-model release with practical reminders that agent reliability depends on the surrounding system, not just the model. Meta’s Muse Wonder targets sustained coding and personal-agent work, but its memory features and mixed-harness benchmarks need testing in your own setup rather than taking vendor rankings at face value. For custom harnesses, Claude’s context-binding rules explain integration breakage, while a fresh Codex report raises cross-session isolation concerns. Around those: SSD-streamed MoE inference, sandbox billing worth checking carefully, editable music through MCP, legal-model specialization, and a cryptographic proof of concept showing why failure to elicit a hidden capability is not proof it is absent.

Lead — Muse Wonder arrives for hosted agents

  • Muse Wonder and Wonder Full launch — Meta adds hosted models aimed at sustained coding and personal-agent workflows.
    • Wonder is available through the Meta Model API and Muse Code; Full is available to Muse Code subscribers.
    • Model card: 1M-token inference context; text, image, video, and audio inputs; text output.
    • Active Memory retrieves prior context; Active Focus targets persistence through blockers. Neither description independently establishes reliability.
    • MemoryBench and FocusBench are internal evaluations; SWE-Marathon compares agent products without holding the harness constant.
    • Muse app rollout starts with subscribers later; no downloadable weights are supplied.
    • Flag: comparisons mix internal runs, third-party results, and provider scores. Evaluate your own harness, not a blanket “best model” claim. (Techmeme)

Agent frameworks & tooling

  • Claude’s distillation defenses constrain context editing — published details explain integration breakage around preserved thinking and model routing.

    • API docs: editing system, tools, or earlier messages invalidates thinking; prefix enforcement defaults on for accounts created from August 31.
    • Incompatible model/account switches can silently drop reasoning; the binding-controls beta header exposes input_transformations.
    • Anthropic reports 90–99% less harvested reasoning; some blocked requests are billed under rules resumed September 24.
    • Flag: vendor-measured effectiveness; these explain existing changes, not a new October 13 API cutoff. (Techmeme)

  • Codex daemon reports now include cross-session environment leakage — a fresh reproducer sharpens the persistent-server complaint into a project-isolation concern.

    • October 13 report: CLI 0.162.1 on macOS exposes the first session’s variable in another session.
    • September’s report describes independently updated backend copies and inherited proxy settings.
    • Reported opt-out: codex features disable daemon_auto_start; stopping an existing daemon is separate.
    • Flag: user reports, not a reproduced vulnerability or confirmed fix; stopping reportedly leaves an updater alive. (HN 568 · 275c)

  • Janas streams MoE experts from SSD — an experimental C inference engine makes oversized checkpoints a testable local-serving option.

    • GPL-3.0-or-later; Linux/Windows x86-64; custom .jns files and machine-specific janas-bench.
    • Author’s hardware/model: 32 GB Intel Arc laptop · 48.4 GB Qwen3-Next-80B.
    • Author reports 24 tok/s without drafts versus llama.cpp’s 2.8; 37 tok/s with drafts is a separate configuration.
    • Flag: one-machine measurements; cache/disk use can induce swapping, and a GPU reset has crashed the desktop. (HN 153 · 52c)

  • Agent37 explains low-cost hosted sandboxes — bursty workloads and gVisor memory sharing underpin an alternative for hosting agents.

    • Product: Hermes and other harnesses, persistent files, sleep/wake, and spending limits.
    • Pricing: $0.37 assumes 57 active hours and deletion; always-on 2 vCPU/4 GB is advertised at $4.76/month.
    • Retained 4 GB disk costs $0.36/month idle; model tokens and integrations meter separately.
    • Flag: founder economics, not tested isolation; gVisor excludes Docker-in-Docker and Android emulators. Full VMs cost more. (HN 132 · 98c)

  • Blokkily exposes a pattern-based DAW through MCP — agents can build editable music rather than return opaque generated audio.

    • Bridge docs: read sessions, write notes, control playback, inspect plugins, and capture screenshots.
    • Edits share the UI’s undoable paths; a local socket restricts access to the app’s user.
    • Supports CLAP/VST3, SoundFonts, MIDI exchange, and WAVE export; Linux is the primary platform.
    • Flag: experimental; no hardware MIDI output or comping, with limited third-party plugin/high-DPI coverage. (HN 60 · 28c)

Models & research

  • GLM-Legal adds domain training and harness co-optimization — legal-workflow evaluation offers a concrete example of specialization beyond generic chat benchmarks.

    • GLM-5.3-Flash base; legal mid-training and post-training environments iterate alongside the harness.
    • Vals evaluation: Harvey LAB 19.17% all-pass; Legal Research Bench 41.83%.
    • API access requires a beta application; AutoClaw integration is described as coming soon.
    • Flag: 19.17% all-pass does not establish autonomous legal reliability; Vals labels weights open, but no download was verified. (HN 576 · 326c)

  • Encrypted circuits expose a limit of capability audits — a constructed backdoor can hide executable capabilities even from weight-access auditors.

    • Paper: small-classifier tests include fine-tuning, weight noise, gradient trigger search, and latent adversarial training.
    • Cryptographic assumptions protect trigger and payload identity; failure to elicit does not establish capability absence.
    • Training provenance and runtime controls complement elicitation tests.
    • Flag: compiled proof of concept with substantial overhead; circuit presence may be detectable. Not evidence ordinary LLMs spontaneously do this. (HN 214 · 112c)
All gathered items - what was cut and why (7)
  • Karpathy’s capability funnel - DEDUP: October 11 standalone coverage; no new artifact in this post. (X @karpathy)
  • AI is a tool - DEDUP: October 12 standalone essay/thread coverage already owns the story. (HN)
  • Self-replication forecast - LOW_UTILITY: simplified unauthenticated access and externally served worm models do not demonstrate autonomous small-model replication in the wild. (Techmeme · Anthropic)
  • Intel D270 - LOW_UTILITY: specifications verified, but no checked price, availability, or reproducible serving measurements. (HN)
  • SolidCraft - OFFSTACK: real MCP and geometric checks, but physical CAD is less relevant than today’s inference and editable music tooling. (HN)
  • Superfluid scheduling - UNVERIFIABLE: direct post failed extraction; truncated artifact link cannot establish implementation. (Bluesky @blu3ph4ntom.bsky.social)
  • Repeat-After-Me framework bypass - UNVERIFIABLE: direct post failed extraction; no checked primary experiment supports the headline. (Bluesky @e-kiledjian.bsky.social)